detection.wiki

Microsoft-Windows-CodeIntegrity › Event 3084

Event ID 3084 — Code Integrity will enable WHQL driver enforcement for this boot session.

Provider
Microsoft-Windows-CodeIntegrity
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security)
Task
WhqlEnforcement
Opcode
WhqlSettings

Description

Code Integrity will enable WHQL driver enforcement for this boot session. Settings Settings. Exemption Exemption.

Message #

Code Integrity will enable WHQL driver enforcement for this boot session.  Settings %1. Exemption %2.

Fields #

NameDescription
Settings HexInt32—
Exemption UInt8—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CodeIntegrity",
    "guid": "4EE76BD8-3CF4-44A0-A0AC-3937643E37A3",
    "event_source_name": "",
    "event_id": 3084,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 127,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:10.407182+00:00",
    "event_record_id": 875,
    "correlation": {
      "ActivityID": "164E10E5-B120-0000-E710-4E1620B1DC01"
    },
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "Microsoft-Windows-CodeIntegrity/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Settings": "0x0",
    "Exemption": 1
  },
  "message": ""
}

References #